Skip to main content
Every statement on this page describes the program running on Solana mainnet. Each one is a field or a rule on chain. This is early, unaudited software: read Risk before you trade.

Three bounds, fixed at open

  • Loss is bounded. The most you can lose is your stake. There is no margin call, no negative balance and no clawback.
  • Payout is bounded. A target cannot exceed a multiple of the stake, config.params.payoutCapMultiple. How a win is paid is under admission and the queue.
  • Time is fixed at open. The tenor is read from config.params.tMaxSeconds and frozen onto the position. It is the indefinite value, under which a position has no protocol clock: it ends at its barrier, its target, a close, its own timer, or the 24 hour refund. A borrow fee runs on the clock beyond a free window.

Admission and the queue

Opening a position takes your stake and nothing else. The program decides whether the position fits when the venue fills the order, against a rule it applies per market and in total. An order that does not fit is returned: your whole stake comes back and no fee is charged. A hedge, a smaller target and a close are never refused by this rule. At a close, your stake comes back at once and the profit is paid from the pool’s free cash. A win is paid in full. Part of it may be paid later, in order. There is no guaranteed time. The amount queued ahead of you is shown. What the pool cannot pay yet joins a queue, first in, first out, and it is funded by cash that other positions leave in the pool. Anyone may send the instruction that delivers funded queue money (pay_queue); it goes to the wallet recorded on the account. When the line is nearly full, a second unpaid win of the same account waits behind its first. The settlement events say how much was paid now and how much was queued. The program has no auto-deleveraging, no socialised loss and no write-down of an amount owed: it is paid in full or stays owed. Deposits to the pool are closed, and a redemption is refused unless the governed flag allows it or the venue is in a wind-down; see providing liquidity.

The pricing path

Your entry is the first price of the venue’s price feed at or after your order’s target slot, a short delay after the order lands. It is a signed quote, and the program verifies it when the filler writes it. The function that prices an order takes the market and the quote and never the stake, so every size fills at the same price. An order is returned when its price does not clear one of these:
  • Time. It comes within a governed number of slots after the target, and a filler writes it inside the fill window.
  • Signatures. At least market.minSignatures distinct keys that the program recognises.
  • Quality. It meets the venue’s quality rule for an entry.
See orders and closes for the rules and Risk for what they do not cover.

The barrier

At high leverage the barrier sits a very small distance from the entry. A move too small to see on a chart ends the position. Barrier and rung are both set as distances from the entry, and they move closer together in the same proportion as leverage rises. Leverage sets how fast the position resolves, and the ratio between the distance to lose and the distance to win stays fixed.

Settlement

Settlement is permissionless for every outcome that has evidence behind it: the barrier touched, the target reached, the position’s own timer run out, and a finite protocol tenor expired. Any address may send that transaction, and the money goes to the owner’s account whoever sent it. Every priced close carries a signed quote from the venue’s price feed. If no quote can be obtained, anybody can close a position with no quote (lastResort) on one of two grounds. If a market has had no posted price for 24 hours (the governed dark_after_min, read as GovTable.darkAfterMin), anyone can close any position on it, and the position gets its stake back. Anyone can post a signed price with provePrice. A position with a finite tenor can also be closed once its tenor plus a governed grace (config.lastResortGraceS) has elapsed. lastResort pays a live position its stake back with the exit fee waived, and a position already stamped at a level that level. It is refused while the oracle is frozen. On a market with trading hours, a position that is not settled before its session’s close ends at par. A voluntary close needs the owner’s authority: a signature, or a session key the owner authorised. The settle that completes it can be sent by anybody, at the first price after a short delay from the request.
Two switches can stop closes, and neither can be lifted by the key that sets it. The guardian can freeze the oracle, which refuses opens and leaves every priced close without a price. It can also disable settles, which refuses every close. Only the config authority lifts either. Read config.oracleFrozen and config.settlesDisabled.

What you sign on an open

You sign a total budget, and the venue takes its fee from inside it, so the debit is at most that number. You also sign min_collateral_out, the smallest position you accept for that budget. The position the budget buys is computed from the live parameters in the slot where the transaction executes. If a governance change in between would buy a smaller position, the transaction refuses. A min_collateral_out of zero is refused (MinCollateralOutRequired). The terms are fixed when the order lands. The entry is not: it is set by the next price. The barrier and the rung are distances from that entry, so their prices exist once the order is filled. Every number below is computed from the live parameters for the exact terms you are about to open:
An interface shows barrierPayout on the same screen as the open button.

Leverage, cap and stake

BTC, ETH, SOL, XRP and gold are listed at a tier of 1000x. The protocol’s payout cap is config.params.payoutCapMultiple. See markets.
  • Leverage decides the distance the price has to move, in either direction, before the position ends. It sets the time horizon of the position, not its shape.
  • The payout cap decides the ceiling. A target above it is refused, and a position with no target of its own has the cap as its target. The payout has no leverage term.
The leverage is 1000x on every market. The market’s tier (market.tier) is a ceiling and the venue’s config.minTier is a floor, so every position opens at 1000x. A request above the ceiling or below the floor is refused. Stakes run between minCollateral and maxCollateral. Each of these is a governed field: read it from the chain. Fees and limits has the values, with the date they were read.

Fees

There is an entry fee (read config.params.entryFeeBps; it is 0, so an open is free), an exit fee on most closes (not on one paid at the barrier, nor on a no-price close that returns the stake), and a borrow fee on the time held beyond a free window (borrowRateBpsPerHour, a governed field; read it rather than assume it). The exit fee is a share of the exit value: a lower rate on a win and a higher rate on a loss. On a gain the terms also withhold part of the gain: the share you keep rises with the size of the move, so a target pays less than its multiple. Fees and limits has the values, dated, and a worked example. Every rate is written on chain, and the ones that apply to a position are frozen onto it at open. A returned order or add returns the whole stake. How it works has each fee, where it is read from and where it goes, and Fees and limits has the rates.

What the product does not do

  • It is not a hedge. A knockout ends the position at the moment a hedge would be needed.
  • It does not fill at the price on your screen. Entry and exit are the venue’s next prices after a short delay. A close you ask for cannot be withdrawn, and its price is not locked until it settles.
  • It does not roll over. A position ends by its own rules, and time is charged once the borrow fee is running.
  • Adding to a position does not defend it. Adding while ahead moves the barrier toward the price. See adding to a position.

Read it on chain

The SDK exports PROGRAM_ID, and configPda() and vaultPda() derive the two addresses. The SDK decodes all of it. It is not public yet. The program’s raw account and event layout is not published; for integration questions, write to support@asymmetra.xyz.